CVE-2026-14631

Summary

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

Severity

medium

CVSS

5.3

EPSS

0.5% (p44)

CWE

CWE-20, CWE-248

Also known as

GHSA-m28w-2pqf-7qgj

Published

2026-07-20

Updated

2026-07-20

Advisory details

Impact

An unauthenticated peer that can reach the webpack-dev-server process can terminate it by sending either a normal HTTP request with a malformed Host header, or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed header triggers an uncaught exception in the host-validation path and crashes the dev server process.

Patches

Fixed in webpack-dev-server 5.2.6 by treating malformed Host and Origin header values as invalid rather than throwing (see PR #5699).

Workarounds

Keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.

References

• https://github.com/advisories/GHSA-m28w-2pqf-7qgj
• https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-m28w-2pqf-7qgj
• https://nvd.nist.gov/vuln/detail/CVE-2026-14631
• https://github.com/webpack/webpack-dev-server/pull/5699
• https://github.com/webpack/webpack-dev-server/commit/f21ed0f44aceb6132abb591ee8b60d770b6e489f
• https://cna.openjsf.org/security-advisories.html

Related advisories

• CVE-2026-52856 — high · Go/github.com/pterodactyl/wings
• CVE-2026-100347 — medium · Go/github.com/getkin/kin-openapi
• CVE-2026-105757 — medium · PyPI/vllm
• CVE-2026-105756 — medium · PyPI/vllm
• CVE-2026-54529 — medium · PyPI/sqladmin
• GHSA-rgqc-3x5p-6gwg — medium · crates.io/postgres-protocol
• CVE-2026-65834 — medium · Go/github.com/projectcapsule/capsule
• GHSA-c8w6-x74f-vmg3#zebrad — medium · crates.io/zebrad

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity